Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Windows XP Pro Event Viewer

  • Please log in to reply
3 replies to this topic

#1 smak451


  • Members
  • 59 posts
  • Local time:11:47 PM

Posted 26 July 2010 - 02:18 AM

EDIT: Moving this from 98 to XP as I believe you mis posted~~boopme

Hey again -- I was looking through my config/driver/device files before doing a clean install w/Win 7.

This Event Viewer shows many "Warning" entries about 2 months ago with messages like "Could not detect IIs installation module or IIS is disabled, skipping the Web Host script mappings component..." and "Your IP address xx.xxx etc. with Network Card xxxxxx is already in use on the network..." and under services (I think) it showed thing like "Remote registry editor enabled and started" along with my Alerter service having been disabled (says its to Alert Admin of any funny business).

Are these normal errors or are they footprints of the intrusion I experienced? I'm trying to isolate where this might have come from. All entries before these were free of any Warnings. Thanks again!

Edited by boopme, 26 July 2010 - 07:52 PM.

BC AdBot (Login to Remove)


#2 Kazinsal


  • Members
  • 17 posts
  • Local time:09:47 PM

Posted 26 July 2010 - 07:43 PM


You're probably looking for the Windows XP Home and Professional board here, not the 95/98/ME one. :thumbsup:

IIS is the built-in webserver that comes with XP Pro. That's not too important. The warning with the IP address is only a problem if you're trying to allocate a static IP that's already used up and can't get into the internet. The "remote registry editor" thing is troublesome, as it allows anyone with your IP and admin password to edit your registry. I suggest you go into Administrative Tools -> Services and disable the Remote Registry service. I'm unsure of the Alerter problem, as I've never encountered it before.

This may be linked to an intrusion, but you should disable the Remote Registry service ASAP.


EDIT: Thanks for the move, boop :flowers:

Edited by Kazinsal, 26 July 2010 - 08:18 PM.

#3 hamluis



  • Moderator
  • 56,281 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:47 PM

Posted 26 July 2010 - 08:13 PM

If you post the Event ID, Source and the detailed explanation for each (seen by double-clicking that line item), you may get some idea.

Generally speaking...any warning or information item in Event Viewer...calls for no action by the user and can be ignored, IMO.


#4 smak451

  • Topic Starter

  • Members
  • 59 posts
  • Local time:11:47 PM

Posted 26 July 2010 - 08:17 PM

Thanks guys, sorry about the mis-posting. Cheers -- S

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users